PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Monday, May 16, 2005 5:49 PM
Subject: RE: [Declude.JunkMail] German political spam
If someone is interested in, I've updated my sober-q filter files.
I've split the patterns in two files: SUBJECT and BODY lines. They will
not
catch more but:
1
short-circuit optimization.
Andrew 8)
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser
Sent: Tuesday, May 17, 2005 12:17 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] German political spam
Has anyone but me noticed
Also, Markus' optimization of checking CMDSPACE before
SUBJECT checking will not work in two cases:
I've discovered another rare one. It seems like certain MTA's does correct
commandspaces and so a forwarded messages from one of this MTA's will pass
the filter files as it hasn't failed
http://www.joewein.de/sw/spam-sober-h.htm
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Dave Marchette
Sent: Sunday, May 15, 2005 00:07
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] German political spam
Anyone else getting hit with
Markus Wrote:
If someone is interested in, I've updated my sober-q filter files.
I'm interested! Thanks Markus!
Bill Green
dfn Systems
---
[This E-mail scanned for viruses by Declude Virus]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL
On 16 May 2005 at 23:49, Markus Gufler wrote:
Thanks!
-Nick
If someone is interested in, I've updated my sober-q filter files.
I've split the patterns in two files: SUBJECT and BODY lines. They
will not catch more but:
1.) The SUBJECT filterfile will be processed only if CMDSPACE has
Anyone else getting hit with massive waves of German spam as
a byproduct of modified Sober code continuing from around 2
pm EDT today, or am I 'unique' in this?
Update:
I've noted that this type of messages always will fail CMDSPACE
Please take care that the links that are part of the
, and Log Parsers.
- Original Message -
From: Marc Catuogno [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Sunday, May 15, 2005 9:34 AM
Subject: RE: [Declude.JunkMail] German political spam
I've added all the phases that I have found in the e-mails that got through
to me. I don't
]
To: Declude.JunkMail@declude.com
Sent: Sunday, May 15, 2005 3:37 AM
Subject: RE: [Declude.JunkMail] German political spam
Anyone else getting hit with massive waves of German spam as
a byproduct of modified Sober code continuing from around 2
pm EDT today, or am I 'unique' in this?
Update
Random addresses on the ones I'm getting. All from SWBell DSL IPs. Not failing any tests other than GIBBERISH, and not even that oneall the time. I'm using SmarterMail, soCMDSPACE isn't an available test for us. I'vehad more than 15 messages get through on my personalaccount alonesince Saturday
with the default
configuration. Download a copy today - http://www.invariantsystems.com
- Original Message -
From: Darrell ([EMAIL PROTECTED]) [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Sunday, May 15, 2005 10:02 AM
Subject: Re: [Declude.JunkMail] German political spam
/URI
integration, MRTG Integration, and Log Parsers.
- Original Message -
From: Marc Catuogno [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Sunday, May 15, 2005 9:34 AM
Subject: RE: [Declude.JunkMail] German political spam
I've added all the phases that I have found in the e
On 15 May 2005 at 10:50, Marc Catuogno wrote:
I am seeing randomized addresses, but they seem to be from related
industries. We are in real-estate, the address are random then @
other real-estate companies, title companies, etc.
Good observation - all of the ones I have received have come
more than 15 is all you got? I've had at least 112.
G.Z.
-- Original Message --
From: Shayne Embry [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date: Sun, 15 May 2005 09:04:48 -0500
Random addresses on the ones I'm getting. All from SWBell
. :-/
Markus
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
Darrell ([EMAIL PROTECTED])
Sent: Sunday, May 15, 2005 4:27 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] German political spam
Actually, looking at this again I
The direct link for spamassassins filter file is
http://www.filterregel.de.vu/rassistische_mails_2.cf
Markus
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type unsubscribe Declude.JunkMail. The archives can be found
rman story for 60-70 years. :-/
Markus
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of
Darrell ([EMAIL PROTECTED])
Sent: Sunday, May 15, 2005 4:27 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] German political spam
Actually, looking at thi
On 15 May 2005 at 18:07, Markus Gufler wrote:
The direct link for spamassassins filter file is
http://www.filterregel.de.vu/rassistische_mails_2.cf
Thank you Markus!
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED],
Here's another one:
http://mailscanner.prolocation.net/german.cf
Bill
- Original Message -
From: Markus Gufler [EMAIL PROTECTED]
To: Declude.JunkMail@declude.com
Sent: Sunday, May 15, 2005 9:07 AM
Subject: RE: [Declude.JunkMail] German political spam
The direct link for spamassassins
On 15 May 2005 at 18:41, Markus Gufler wrote:
Excellent - Good job thanks for sharing!
-Nick
Ok, I've added all subject line patterns (my, Marc's Nicks and both
Spamassassin cf-files) to one declude filter file.
Please note that I've commented out h eise.de and s piegel.de body
filter
Subject: RE: [Declude.JunkMail] German political spam
On 15 May 2005 at 10:50, Marc Catuogno wrote:
I am seeing randomized addresses, but they seem to be from related
industries. We are in real-estate, the address are random then @
other real-estate companies, title companies, etc.
Good
Nick wrote:
Seems to be a very sophisticated campain - of which at least 90% so
far are coming from clean domains/clean ip's. Maybe someone Matt? ,
can figure out some sort of pattern we can target from the spamware?
I could code up a quick external test in VBScript that would capture
this
Correct. And along those lines, two thoughts come to mind.
1 Many of your users may see hundreds(maybe thousands) of
nondeliverable\unknown user bounces. 'Damage control Monday'
should be fun this week.
Strange but at the moment I can't see only a very low number of NDR's
Some
]
To: Declude.JunkMail@declude.com
Sent: Sunday, May 15, 2005 3:00 PM
Subject: RE: [Declude.JunkMail] German political spam
Correct. And along those lines, two thoughts come to mind.
1 Many of your users may see hundreds(maybe thousands) of
nondeliverable\unknown user bounces. 'Damage control Monday
: [Declude.JunkMail] German political spam
Ok, I've added all subject line patterns (my, Marc's Nicks and both
Spamassassin cf-files) to one declude filter file.
Please note that I've commented out h eise.de and s piegel.de body
filter files and also that I usa a weight of 200.
Markus
---
This E-mail came from
Yup, got hit with loads of 'em!
G.Z.
-- Original Message --
From: Dave Marchette [EMAIL PROTECTED]
Reply-To: Declude.JunkMail@declude.com
Date: Sat, 14 May 2005 22:07:09 -0700
Anyone else getting hit with massive waves of German spam as a byproduct
26 matches
Mail list logo
